- Added submission from Apache JMeter from 2018-02-11.

2018/1xxx/CVE-2018-1297.json

@@ -1,8 +1,35 @@
 {
    "CVE_data_meta" : {
-      "ASSIGNER" : "cve@mitre.org",
+      "ASSIGNER" : "security@apache.org",
+      "DATE_PUBLIC" : "2018-02-11T00:00:00",
       "ID" : "CVE-2018-1297",
-      "STATE" : "RESERVED"
+      "STATE" : "PUBLIC"
+   },
+   "affects" : {
+      "vendor" : {
+         "vendor_data" : [
+            {
+               "product" : {
+                  "product_data" : [
+                     {
+                        "product_name" : "JMeter",
+                        "version" : {
+                           "version_data" : [
+                              {
+                                 "version_value" : "2.x"
+                              },
+                              {
+                                 "version_value" : "3.x"
+                              }
+                           ]
+                        }
+                     }
+                  ]
+               },
+               "vendor_name" : "Apache Software Foundation"
+            }
+         ]
+      }
    },
    "data_format" : "MITRE",
    "data_type" : "CVE",
@@ -11,7 +38,26 @@
       "description_data" : [
          {
             "lang" : "eng",
-            "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+            "value" : "Apache JMeter uses an unsecure RMI connection in Distributed mode. Severity: Important. Vendor: The Apache Software Foundation. Versions Affected: JMeter 2.X, 3.X. Description [0]: When using Distributed Test only (RMI based), jmeter uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code. This only affect tests running in Distributed mode. Mitigation: * Users must use last version of Java 8 or Java 9 * Users must upgrade to last JMeter 4.0 version and use the default / enabled authenticated SSL RMI connection. Besides, we remind users that in distributed mode, JMeter makes an Architectural assumption that it is operating on a 'safe' network. i.e. everyone with access to the network is considered trusted. This typically means a dedicated VPN or similar is being used. Example: * Start JMeter server using either jmeter-server or jmeter -s * If JMeter listens on unsecure rmi connection (ie you can connect to it using a JMeter client), you are vulnerable Credit: This issue was reported responsibly to the Apache Tomcat Security Team by Brenden Meeder. - Philippe Mouawad on behalf of the Apache JMeter PMC [0] https://bz.apache.org/bugzilla/show_bug.cgi?id=62039"
+         }
+      ]
+   },
+   "problemtype" : {
+      "problemtype_data" : [
+         {
+            "description" : [
+               {
+                  "lang" : "eng",
+                  "value" : "Unauthorized code access"
+               }
+            ]
+         }
+      ]
+   },
+   "references" : {
+      "reference_data" : [
+         {
+            "url" : "http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpaNzk5am8oFe07RQ-kynCsQv54yB-uYs9bEnz7tbX-O7g%40mail.gmail.com%3E"
          }
       ]
    }